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CHAPTER 


15 


TROUBLESHOOTING 
WINDOWS XP 


After reading this chapter and completing the exercises, 
you will be able to: 


# Collect documentation about your systems to aid in trouble- 
shooting and preventing problems 


# Review common-sense approaches to troubleshooting 


+ 


Troubleshoot general problems with Windows XP Professional 


+ Use some of the troubleshooting tools found in Windows XP 
Professional 


i aa sa e caaei XP Professional, as with any operating system, is 
an important and vast subject area. In this chapter, you learn how to detect, 
isolate, and eliminate problems with installation, printing, remote access, net- 
working, disks, and other aspects of a Windows XP Professional system. 


In addition to the techniques discussed in this chapter, important trou- 
bleshooting options and features of Windows XP Professional have already 
been covered in previous chapters. The Registry is a common location for 
problems as well as a source for implementing solutions. The Registry is dis- 
cussed in Chapter 12 “Working with the Windows XP Registry.” The 
Windows boot process can sometimes be prey to problems. These problems 
and related solutions are covered in Chapter 13, “Booting Windows XP.” 
Catastrophic events, virus infections, or simple hardware failure can leave you 
without a functioning system. Fault tolerance, system recovery, and working 
with backups are discussed in Chapter 14, “Windows XP Professional Fault 
Tolerance.” Keep in mind the troubleshooting advice provided in previous 
chapters as you attempt to prevent and resolve problems involving 
Windows XP Professional. 
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GENERAL PRINCIPLES OF TROUBLESHOOTING 


When troubles arise in Windows XP Professional, you must take action to resolve the 
issues at hand as quickly as possible. Troubleshooting is the art and science of systemat- 
ically diagnosing and eliminating problems in a computer system. Although trou- 
bleshooting may sound exciting, in reality it is usually a fairly tedious process. In the 
following sections, we present some procedures and common-sense guidelines that 
should improve your troubleshooting skills and help you keep downtime to a minimum. 


Collect Information 


The first rule of troubleshooting is: You can never have too much information. In fact, 
information is your best weapon not just for resolving problems, but also for preventing 
them in the first place. Useful, detailed information typically falls into three areas: your 
system (hardware and software), previous troubleshooting, maintenance, and configura- 
tion activities, and the current problem. 


Collecting information about your system’s hardware and software is preventive main- 
tenance. All pertinent information, kept in an accessible form and location, is called a 
Computer Information File (CIF).A good CIF provides detailed information about 
the hardware and software products that comprise your computer (and even your entire 
network). A CIF is not just a single file, but an ever-expanding accumulation of data 
sheets sorted into related groupings. Your CIF should be stored in a protected area (such 
as a safe or fireproof vault) that can be accessed in the event of an emergency (a bank’s 
safety deposit box won’t allow you to get at the information at 3:00 in the morning). 
Obviously, constructing a CIF from scratch is a lengthy process, but one that will be 
rewarded with problems solved, easy reconfigurations, or simplified replacement of failed 
components. 


Here are some of the important elements you'll want to include in your CIF: 
a Platform, type, brand, and model number of each component 
a Complete manufacturer specifications 


a Configuration settings, including jumpers and dip switches, as well as what 
each setting means, including IRQs, DMA addresses, memory base addresses, 
port assignments, and so forth 


a The manual, user’s guide, or configuration sheets 

a Version of BIOS, driver software, patches, fixes, etc., with floppy copies 
a Printed and floppy copies of all parameter and initialization files 

a Detailed directory structure printout 

a Names and versions for all installed software 


a Network-assigned names, locations, and addresses 
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Status of empty ports or slots, upgrade options, or expansion capabilities 


System requirements, such as the manufacturer’s listed minimum system 
requirements for its operating system, driver, application, hardware, etc. 


Warranty information, such as service phone numbers and e-mail addresses, 
and support Web sites 


Complete technical support contact information 

Error log with detailed and dated entries of problems and solutions 
Date and location of the last complete backup 

Location of backup items and original software 

Network layout and cabling map 


Copies of all software, operating system, and driver installation or source CDs 
and/or floppies 


Each of these items should be dated and initialed. However, your CIF is not complete 
if it contains only hardware and software details. You should also include the nonphysi- 
cal characteristics of your system, such as: 


Information services present, such as Web, FTP, e-mail, newsgroups, message 
boards, etc. 


Important applications, such as productivity suites (Microsoft Office), collabora- 
tion utilities, white board applications, video conferencing, etc. 


Plans for future service deployments 


A mapping or listing of related hardware and software with each service 
or application present on the system 


Structure of authorized access and security measures 
Training schedule 

Maintenance schedule 

Backup schedule 

Contact information for all system administrators 
Personnel organization or management hierarchy 
Workgroup arrangements 

Online data storage locations 

In-house content and delivery conventions 
Authorship rights and restrictions 


Troubleshooting procedures 
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Neither of these lists is exhaustive. As you operate and maintain your systems, you'll dis- 
cover numerous other important items to add to the CIF Don’t be bashful about cus- 
tomizing these lists to meet your particular needs and circumstances—if it doesn’t work 
for you, it doesn’t work at all. Period. 


Remember, if you don't document it, then you won't be able to find it when 
Q you really need it. A good way to keep any CIF current is to add to, remove, 
tip] Or modify its contents each time you make a system modification. Performing 

a quarterly or semi-annual audit of each CIF is not a bad idea, either. 


It is essential that the contents of the CIF be complete and up-to-date. Without thor- 
ough, specific, and accurate information about the products, configuration, setup, and 
problems associated with your network, the CIF will be all but useless. Keep in mind 
that the time you spend organizing your CIF will reduce the time required to locate 
information when you really need it. It is wise to create a correlation system so you can 
easily associate items in the CIF with the actual component, such as an alphanumeric 
labeling system. For instructions on how to create a CIE see Hands-on Project 15-2. 


We recommend maintaining both a printed/written version and an electronic version of 
this material. Every time a change, update, or correction occurs, it should be documented 
in the electronic version, and a printout made and stored. Murphy’s Law guarantees that 
the moment you need your electronic data most, your system will not function. 


Use Common-Sense Troubleshooting Guidelines 


When problems occur, you would like to be at your sharpest. However, as a corollary to 
Murphy’s Law, you'll probably find that problems tend to occur when you are stressed, 
short on time, or when it is just generally inconvenient. If you take the time now to 
keep your CIF up-to-date and heed the following common-sense guidelines, you'll take 
some of the headache out of troubleshooting, and you'll be better prepared to resolve 
problems quickly. Although common sense is sometimes in short supply, it is a key ingre- 
dient for successful troubleshooting. 


a Be patient—Anger, frustration, hostility, and frantic impatience usually cause 
problems to intensify rather than dissipate. 


a Be familiar with your system’s hardware and software—If you don’t know what the 
normal baselines for your system are, you may not know when a problem is 
solved or when new problems surface. (See Chapter 10, “Performance Tuning” 
for information on creating baselines.) 


a Attempt to isolate the problen—When possible, eliminate segments or compo- 
nents that are functioning properly, thus narrowing the range of suspected 
sources for a problem or failure. 


a Divide and conquer—Disconnect, one at a time, as many nonessential devices 
as possible to narrow the scope of your investigation. 
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a Eliminate suspects—Move suspect components, such as printers, monitors, 
mice, or keyboards, to a known working computer to see if they work 
in their new location. If they work, they're not at fault; if they don’t, they 
may very well be involved in the problem you're trying to solve. 


a Undo the most recent change—If you have recently made a change to your sys- 
tem, the simplest fix may be to back out of the most recent alteration, 
upgrade, or change made to your system. 


a Investigate common points of failure first—The most active or sensitive compo- 
nents also represent the most common points of failure—including hard dri- 
ves, cables, and connectors. 


a Recheck items that have caused problems before—As the old axiom goes, history 
does repeat itself (and usually right in your own backyard). 


a Try the easy and quick fix first—Try the easy fixes before moving on to the 
more time-consuming, difficult, or even possibly destructive measures. 


a Let the fault guide you—The adage “Where there is smoke, there is fire” applies 
not only to the outside world, but to computer problems as well. Investigate 
components and system areas associated with the suspected fault. 


a Makes changes one at a time—A long flight of stairs is best traversed one step 
at a time; attempting to leap several or all of the steps may result in injury 
or death. When troubleshooting, a step-by-step process enables you to iden- 
tify the solution clearly when you stumble upon it. 


a Repeat the failure—Often repeating an error is the only way to identify it. 
Transient and inconsistent faults are difficult to diagnose until you see a pat- 
tern in their occurrence. 


a Keep a detailed log of errors and attempted solutions—Keep track of everything 
you do (both successful and failed attempts). This will prove an invaluable 
resource when an error recurs on the same or a different system, or when the 


same system experiences a related problem. 


a Learn from mistakes (your own and others’)—Studying the mistakes of others 
can save you from repeating them; a wise person uses failures to find a 
better solution. 


a Experiment—lIf your diagnosis is inconclusive, try similar tasks to the ones that 
provoke the problem to see if a pattern develops. 


There is probably not much in this list of common sense items that you don’t already 
know. The hardest part is remembering these in the heat of a crisis. 
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TROUBLESHOOTING TOOLS 


Becoming familiar with the repair and troubleshooting tools native to Windows XP 
Professional can save you countless hours when troubleshooting. In the next sections, we 
detail the use of the Event Viewer and the Computer Management tools. 


Event Viewer 


The Event Viewer is used to view system messages regarding the failure and/or success of 
various key occurrences within the Windows XP Professional environment (see Figure 15-1). 
The items recorded in the Event Viewer’ logs inform you of system drivers or service failures 
as well as security problems or misbehaving applications (see Hands-on Project 15-1). 


B Event Viewer DER 


Fie Action View Help 


e> 8) ¢A8 e 


H] Event Viewer (Local) | System 39 event(s) 
3) Application 
Security 


(3) System 


7/6/2001 6:26:35PM_ Service Control Manager None 
7/6/2001 6:26:34PM_ Service Control Manager None 
7/6/2001 6:26:32PM — Service Control Manager None 
7/6/2001 6:26:32 PM — Service Control Manager None 
7/6/2001 6:25:38 PM — Service Control Manager None 
7/6/2001 6:25:38 PM — Service Control Manager None 
7/6/2001 6:24:08PM_ Service Control Manager None 
746/2001 6:23:07 PM = Service Control Manager None 
746/2001 6:23:07 PM__ Service Control Manager None 
7/6/2001 6:23:07 PM = Service Control Manager None 
7/6/2001 6:23:07 PM__ Service Control Manager None 
7/6/2001 6:23:07 PM — Service Control Manager None 
7/6/2001 6:22:10 PM Distributed Link Trackin... None 
7/6/2001 6:22:09 PM = W32Time None 
7/6/2001 6:14:37 PM — eventlog None 
7/6/2001 6:14:37 PM — eventlog None 
7/6/2001 6:14:53 PM srservice None 


Figure 15-1 Event Viewer with System log selected 
Located in the Administrative Tools section of the Control Panel, the Event Viewer is 
used to view the logs that Windows XP Professional creates automatically: 


a System log—Records information and alerts about Windows XP Professional’s 
internal processes, including hardware and operating system errors, warnings, 
and general information messages. 


a Security log—Records security-related events, including audit events for failed 
logons, user rights alterations, and attempted object accesses without sufficient 
permissions. 


a Application log—Records application events, alerts, and some system messages. 
a Directory Service—Records events related to the Directory Service. 
a DNS Service—Records events related to the DNS Service. 


a File Replication Service—Records events related to the File Replication Service. 
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Each log records a different type of event, but all the logs collect the same meta- 
information about each event: date, time, source, category, event, user ID, and computer. 
Each logged event includes some level of detail about the error, from an error code num- 
ber to a detailed description with a memory HEX buffer capture. For example, Figure 
15-2 shows the properties of a logged event related to the workstation’s attempt to reg- 
ister a DNS address, or an A record, with an unreachable directory server. Most system 
errors, including stop errors that result in the blue screen, are recorded in the System 
log, allowing you to review the time and circumstances of a system failure. The details 
in the Event Viewer can often be used as clues in your search for the actual cause of a 
problem. However, most event log details offer little information on resolving the prob- 
lems they document. 


Event Properties 


Event | 


Date: 7/6/2001 Source: Dnsåpi 
Time: 6:37:37 PM Category: None 
Type: Warming EventID: 11165 
User: N/A 

Computer: WxPPRO-199 


Description: 


The system failed to register host (A) resource records (ARs) for 
network adapter 
with settings: 


Adapter Name : {77D542F8-E0BC-40FB-B073-1DFE29579B67} 
Host Name : wxppro-199 
Primary Domain Suffix : lanw-office.local 
DNS server list : 
24.93.35.32, 24.93.35.33 
Sent update to server : <?> 


Data: © Bytes O Words 
0000: 2a 23 00 00 


Figure 15-2 Event Viewer's Event Properties windows displays logged event details 


Computer Management Tool 


Windows XP Professional builds on the robustness of Windows 2000, and on the conve- 
nience of its Plug and Play assisted configuration capabilities. In Windows XP, these same 
capabilities provide easy access to troubleshooting tools for nearly every aspect of the oper- 
ating system. A large number of these tools are collected into a single interface called the 
Computer Management tool (see Figure 15-3), found in the Performance and Maintenance 
Tools display in the Administrative Tools application within the Control Panel. 
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© Computer Management 


a File Action View Window Help 
e» Om) 8 e 


(3) Computer Management (Local) 


Hvert Viewer Extension Snap-in Displays event logs. 
elf] Event Viewer ba Shared Folders Displays shared folders, 


l Shared Folders Glocal Users and Groups Extension Snap-in Manages Local Users anc 
E Local Users and Groups 


4 Performance Logs and... Extension Snap-in Configures performance 
Device Manager 


Device Manager 


[El 3 Performance Logs and Alerts Boevice Manager 


E E7] Storage 


H-E Removable Storage 
Disk Defragmenter 
Disk Management 
El Te Services and Applications 


Figure 15-3 The Computer Management tool makes most management tools available 


through a single management console 


The Computer Management tool includes many tools identical to those in Windows 2000; 
there are some new entries, but some entries have been dropped (system information and 
logical drives are the most noteworthy in this group). Grouping these utilities in a single 
interface makes locating and resolving problems on key system components easier than 
ever before (see Hands-on Project 15-3). The Computer Management console is divided 
into three sections: System Tools, Storage, and Services and Applications. The System Tools 
section contains five individual tools: 


Event Viewer—Used to view system messages regarding the failure and/or suc- 
cess of various key occurrences within the Windows XP Professional environ- 
ment. Details of system errors, security issues, and application activities are 
recorded in the logs viewed through the Event Viewer. See the description 

of the Event Viewer earlier in this chapter. Hands-on Project 15-1 shows you 
how to use the Event Viewer. 


Shared Folders—Used to view shared folders defined on the local system. This 
interface shows hidden and public shares, current sessions, and open files, and 
also allows you to view and alter the share configuration settings for user limits, 
caching, and permissions. 


Local Users and Groups—Used to create and manage local user accounts and 
groups. (This tool is disabled when the Active Directory is present.) Details 
on use, examples, and hands-on projects for this tool are included in 
Chapter 5, “Users, Groups, Profiles, and Policies.” 


Performance Logs and Alerts—Another means to access the Performance moni- 
toring tool of Windows 2000 (the use of this tool in troubleshooting is rather 
tedious and complex; see Chapter 11, “Windows XP Professional Application 
Support,” for examples and hands-on projects involving this tool). 
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a Device Manager—Used to view and alter current hardware configurations 
of all existing devices. Details on how to use, examples, and hands-on projects 
for this tool appear in Chapter 3, “Using the System Utilities.” 


The Storage section of Computer Management presents three tools for administering 
storage devices. Details on use, examples, and hands-on projects appear in Chapter 4, 
“Managing Windows XP File Systems and Storage.” 


a Removable Storage—Manages removable media such as floppy disks, tapes, and 
Zip drives. 


a Disk Defragmenter—Improves the layout of stored data on drives by reassem- 
bling fragmented files and aggregating unused space. 


a Disk Management—Views and alters the partitioning and volume configura- 
tion of hard drives. 


The Services and Applications section contains management controls for various 
installed and active services and applications. Though the actual contents of this section 
depend on what is installed on your system, some common controls include: 


a Services—Stops and starts services and configures the startup parameters for 
services (such as whether to launch when the system starts and whether 
to employ a user account security context to launch the service). Hands-on 
Project 15-8 shows you one way to use this tool. 


a WMI Control—Configures and controls the Windows Management 
Instrumentation service, a service designed for Web-based or network access. 
This tool allows network management systems (or related software) to inter- 
act with agent software on a Windows XP Professional machine to install, set 
up, or update system or application software and related configuration data. 


a Indexing Service—Defines the corpus (collection of documents indexed for 
searching) for the Indexing Service. For information on using this tool, con- 
sult the Microsoft Windows 2000 Server Resource Kit. 


Troubleshooting Wizards and Widgets 


Continuing the trend established in Windows 2000, Windows XP Professional includes a 
great many troubleshooting Wizards associated with specific system components or services. 
For example, the Settings tab in the Display Properties applet (most easily accessed by right- 
clicking any unoccupied spot on the desktop, then selecting the Properties entry in the result- 
ing pop-up menu) includes a Troubleshoot button, as shown in Figure 15-4. Clicking that 
button brings up the Video Display Troubleshooter depicted in Figure 15-5; selecting any 
of its entries leads you through a series of questions with answers and explanations that 
deal very effectively with common sources of trouble. Similar buttons for other system 
controls, including Phone and Modem Options (which also has a troubleshooting but- 
ton), or the Local Area Connection Properties, might be labeled “Repair” instead, but 
they offer similar kinds of guided troubleshooting support. 
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Display Properties 


Display: 
Default Monitor on S3 VIRGE DX/GX 


Screen resolution Color quality 


Less J More [High (24 bit) x] 
800 by 600 pixels [Ce ft E 


Troubleshoot... Advanced 


Figure 15-4 Settings tab in the Display Properties applet 


(0) Help and Support Center 


Q- Q A E Index s Z Favorites +S) History m Support z) Options 
Search M 5) © Help and Support Center 


Set search options Windows XP Professional 
video Display Troubleshooter 
What problem are you having? 


I receive the following message: "Display problems. This program can't continue." 


My display flickers or is garbled. 


I cannot install my monitor. 


I am having a problem with the multiple monitor feature. 
videos or animations do not work correctly. 


I cannot set the video resolution above 640 x 480 with 16 colors. 


Figure 15-5 The Video Display Troubleshooter 


As you investigate the management utilities or Control Panel applets for the system 
aspects or components you’re troubleshooting, don’t overlook the kinds of help that 
the system itself can provide. One of the biggest changes from Windows 2000 to 
Windows XP Professional is the adoption of a task-oriented metaphor to provide help 
and guidance, where troubleshooting tasks figure prominently in the lists of tasks for 
which help and support are available. 
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TROUBLESHOOTING INSTALLATION PROBLEMS 


Unfortunately, the installation process for Windows XP Professional is susceptible to several 
types of errors: media errors, domain controller communication difficulties, Stop message 
errors or being hung up on a blue screen, hardware problems, and dependency failures. The 
following list contains a short synopsis of each error type and possible solutions: 


Media errors—Media errors are problems with the distribution CD-ROM itself, 
the copy of the distribution files on a network drive, or the communication 
link between the installation and the distribution files. The only regularly suc- 
cessful solution to media errors is to switch media: copying the files to a net- 
work drive, linking to a servers CD-ROM, or installing a CD-ROM on the 
workstation. If media errors are encountered, always restart the installation 
process from the beginning. 


Domain controller communication difficultiee—Communication with the domain 
controller is crucial to some installations, especially when attempting to join 
a domain. Most often this problem is related to mistyping a name, password, 
domain name, etc., but network failures and offline domain controllers also 

can be involved. Verify the availability of the domain controller directly and 
from other workstations (if warranted), and then check that no entries were 
mistyped during the installation process. 


Stop message errors or halting on the blue screen—Using an incompatible or dam- 
aged driver is the most common cause of Stop messages and halting on the 
blue screen during installation. If any error information is presented to you, 

try to verify that the proper driver is in use. Otherwise, double-check that your 
hardware has the drivers necessary to operate under Windows XP Professional. 


Hardware problems—If you failed to verify your hardware with the HCL 
(hardware compatibility list), or a physical defect has occurred in a previously 
operational device, strange errors can surface. In such cases, replacing the 
device in question is often the only solution. Before you go to that expense, 
however, double-check the installation and configuration of all devices within 
the computer. Sometimes, manual resolution of conflicts that Plug and Play 

is unable to resolve automatically can cure hardware problems. 


Dependency failures—The failure of a service or driver owing to the failure of 
a foundation class, or of some other related service or driver, is called a 
dependency failure. An example is the failure of Server and Workstation ser- 
vices because the NIC fails to initialize properly (see Hands-on Project 15-8). 
Often Windows XP Professional will boot despite such errors, so check the 
Event Viewer (see Hands-on Project 15-1) for more details (see Figure 15-6 for 
an example of a warning reported because a common service proves to be 
unavailable). Most dependency errors usually appear immediately after OS or 
new software installation, or alteration in system configuration. 
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Event Properties 


Event | 


Date: Source: NETLOGON 
Time: 1:03:29 PM Category: None 
Type: Error EventID: 5719 

User: N/A 

Computer: WxPPRO-134 


Description: 

No Domain Controller is available for domain LAN'W-OFFICE due to the 
following: 

There are currently no logon servers available to service the lagon 
request. . 

Make sure that the computer is connected to the network and try again. IF 
the problem persists, please contact your domain administrator. 


For more information, see Help and Support Center at 
http: //go.microsoft.com/fwlink/events. asp. 


Data: © Bytes O Words 
0000: Se 00 00 c0 


Figure 15-6 Event Properties dialog box 


Just knowing about these installation problems can help you avoid them. However, 
successfully installing Windows XP Professional does not eliminate the possibility of 
further complications. Fortunately, Microsoft has included several troubleshooting tools 


that can help locate and eliminate most system failures (see the “Troubleshooting Tools” 
section earlier in this chapter). 


TROUBLESHOOTING PRINTER PROBLEMS 


Problems with network printers can often bring normal activity to a halt. They can 
occur anywhere between the printer’s power cable and the application that’s attempting 
to print. Systematic elimination of possible points of failure is the only reliable method 
for eliminating such errors. Here are some useful tips for troubleshooting common 
printer problems: 


a Always check that the physical components of the printer—cable, power, paper, 
toner, and so on—are present, properly loaded, or connected, as appropriate. 


a Make sure the printer is online. There is typically a light or an LCD message 
to indicate this. You may need to press the Reset button or an Online button 
to set or cycle the printer into online mode. 


a Make sure the printer server for the printer is booted. 
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a Verify that the logical printer on both the client and server sides exist, and 
check their configuration parameters and settings. For details on logical print- 
ers and their multitudes of controls, see Chapter 9, “Printing and Faxing.” 


m Check the print queue for stalled jobs (see Figure 15-7, which shows a print- 
ing print job). Note: if a print job does not show an explicit status (such as 
waiting, paused, printing, etc.) you can assume it is stalled. The print queue is 
accessed by clicking the Start menu, selecting Printers and Faxes, selecting 
the printer whose queue you wish to examine, then clicking the “See what’s 
printing” entry in the Printer Tasks list. 


Š HP LaserJet 4 on W2KP-12 


Printer Document View Help 


Document Name Status Owner Pages Size 
[a] sysparse.log - Notepad Printing Administrator 3/8 18.2 KB/50.3 KB 


Figure 15-7 The default window for any printer shows the contents of its print queue 


a Reinstall or update the printer driver in case it’s corrupt or incorrect. 
a Attempt to print from a different application or a different client. 
a Attempt to print using Administrator access. 


a Stop and restart the spooler using the Services tool found through Computer 
Management (try Hands-on Project 15-4). 


a Check the status and CPU usage of the spoolsv.exe process using the Task 
Manager (see Figure 15-8). If the spooler seems to be stalled—it will either 
be obtaining no CPU time at all or consuming most of the CPU—you 
should stop and restart the spooler service. 


m Check the free space on the drive where the print spool file resides, and 
change its destination if less than 100 MB of free space is available. The 
amount of free space that a spooler file needs is a function of the size and 
number of print jobs and the logical printer’s settings, but in most cases, 

100 MB is sufficient. You should change the spool file host drive if there is 
insufficient space or you suspect the drive is not fast enough. Make this 
change on the Advanced tab of the Server Properties dialog box accessed from 
the File menu in the Printer Folder. See Chapter 9 for more information. 
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El Windows Task Manager DER 


Fie Options View Help 


Applications | Processes | Performance ll Networking | 


Image Name User Name CPU Mem Usage “a 
msmsgs.exe Administrator 00 1,364 K 
spoolsv.exe SYSTEM 00 6,352 K 
svchost.exe LOCAL SERVICE oo 3,580 K 
svchost.exe NETWORK SERVICE 00 2,692 K 
wpabaln.exe Administrator 00 2,008 K 
psp.exe Administrator 01 1,500 K 
svchost.exe SYSTEM oo 15,968 K 
svchost.exe SYSTEM oo 3,488 K 
Isass.exe SYSTEM 00 648 K 
wuauclt,exe Administrator 00 3,748 K 
services,exe SYSTEM 00 2,524 K 
winlogon.exe SYSTEM 00 6,748 K 
csrss,exe SYSTEM oo 3,072 K 
smss.exe SYSTEM 00 332K 
mmc.exe Administrator oo 3,308 K 
explorer.exe Administrator oo 10,836 K 
System SYSTEM 00 216K 


System Idle Process SYSTEM 95 20K a 


[C] Show processes from all users End Process 


Processes: 19 CPU Usage: 5% Commit Charge: 95188K } 63284 


Figure 15-8 The Windows Task Manager, Processes tab 


Table 15-4 Printer Troubleshooting 
Network Printing Problem Solutions 


Pages print, but only a single character 1. If the job has not completed printing, delete 
appears on each page. it from the print queue to prevent wasting 
--Of-- more paper. 

Pages print but they include control codes. | 2. Remove and reinstall the logical printer and/or 
=-O!-- the printer driver on the client (if only a single 
Pages print, but they show random workstation experiences the problem) or on the 
characters instead of the desired server (if all workstations experience the 
document. problem). 

. Verify that the data type set in the logical printer 
is correct for the application used, printer driver 
installed, and capabilities of the physical print device. 

4. Stop and restart the spooler service. 


An access denied or no access available | This is typically caused by improper permissions 
message is displayed when a print job defined on the printer share. Double-check the 

is submitted. permission settings. You may also need to review the 
group memberships of the affected users if you are 
employing any Deny permissions on the printer share. 


A network attached printer shows an A network communication or identification error 
error light on the network interface. has occurred. Cycling the power on the printer may 
resolve the problem. If not, try disconnecting then 
reconnecting the network media while the printer 
is powered off. 
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Table 15-1b Printer Troubleshooting (continued) 


Network Printing Problem 


No documents are being created by 
the physical print device, but the print 
queue shows that the job is printing. 


Solutions 


1. View the print queue to see if a print job is 
stalled or paused. If so, delete or resume the 
print job. 

. If no other print job is present, delete the 
current print job and resubmit it from the 
original application. 

. Stop and restart the spooler service. 


The printer share is not visible from a 
client (i.e., does not appear in 

Network Neighborhood or My Network 
Places). 


1. The client system may not be properly connected 
to the network. Shut down the client, check all 
physical network connections, reboot. Test 
whether you can access any other network 
resources. 

. Check the installed protocol and its settings, 
especially if TCP/IP is being used. 

. Check the domain/workgroup membership of 
the client. 


On larger print jobs, pages from the 
end of the print job are missing from 
the printed document. 


This can occur when insufficient space is available 
on the drive hosting the spooler file. Either free up 
space on the host drive or move the spooler file to 
a drive with more available space. 


For a starter step-by-step on printer troubleshooting, try Hands-on Project 15-4. This 
list covers most common print-related problems. For more tips on troubleshooting, con- 
sult the Microsoft Windows XP Professional Resource Kit. 


TROUBLESHOOTING RAS PROBLEMS 


Remote Access Service (RAS) is another area with numerous points of possible failure— 
from the configuration of the computers on both ends, to the modem settings, to the 
condition of the communications line. Unfortunately, there is no ultimate RAS trou- 
bleshooting guide, but here are some solid steps in the right direction: 


a Check all physical connections. 


a Check the communication line itself, with a phone if appropriate. 


a Verify the RAS configuration and the modem setup by attempting to estab- 
lish a connection to another server or by deleting and recreating the connec- 
tion object. For detailed examples and hands-on projects, see Chapter 8, 
“Internetworking with Remote Access.” 


a Check that both the client and the server dialup configurations match, 
including speed, protocol, and security. See Figure 15-9 for an example of the 
security settings for a dialup connection. You'll need to view the other tabs 
to compare and confirm speed, protocol, and other connection settings. 
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* Course 


Technology Properties 


| General || Options | Security | Networking | Advanced | 


Security options 
© Typical (recommended settings) 
Validate my identity as follows: 


Allow unsecured password 


of s 


O Advanced (custom settings) 


Ising these settings requires a knowledge 


Interactive logon and scripting 
C Show terminal window 


C Run script: 


Automatically use my Windows logon name and 


password (and do any) 


Require data encryption (disconnect if none) 


ecurit: 


Figure 1 


? 


Tip 


5-9 Setting Security options 


Verify that the user account has RAS privileges. 


Inspect the RAS-related logs: Device.log and Modemlog.txt. Look for errors 
involving failure to connect, failure to dial, failure to authenticate, failure 

to negotiate encryption, failure to establish a common protocol, and link 
termination. 


Remember that Multilink and callback do not work together; you must 
select one or the other. Because nobody has developed technology to per- 
form multi-line callbacks, only single-line callbacks are possible. Figure 15-10 
shows a configuration setting on a connection object that allows the caller to 
define a specific callback number to complete a dial-up connection (to access 
the window shown, select Start | Control Panel | Network Connections, then 
select the connection, then select the Dial-up Preferences entry in the 
Advanced menu at the top of the Network Connections window). 


Autodial and persistent connections may cause a computer to attempt RAS 
connection with each logon; in some cases, you may need to disable such set- 
tings to permit easier troubleshooting of connection problems. 


Most RAS problems are related to misconfiguration. For more details on RAS, 
refer to Chapter 8 or the Microsoft Windows XP Professional Resource Kit. 
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Dial-up Preferences 


[ Autodial| Callback | 


When you dial into a server, it may offer to call you back to reduce 
your phone charges. Specify whether you want callback. 
(Callback is not supported for virtual private network [VPN] 
connections.) 


C No callback 
C Ask me during dialing when the server offers 


@ Always call me back at the number(s) below: 


Phone number 
& Standard 28800 bps Modem (COM2) 


Figure 15-10 Dial-up Preferences, Callback tab 


Table 15-2 RAS Troubleshooting 
Network Printing Problem Solutions 


The connection object fails to establish 1. Check the username, password, and 

a network link with the remote server. phone number. 

2. Verify that the modem device is powered on and 
properly connected to the computer and the 
phone line. You should also check the installed 
driver and update it if necessary. 

. Verify that the security settings match those 
required by the remote server. 

. Verify that the protocol settings match those 
required by the remote server. 


The client has multilink enabled and . Verify that the remote server supports multilink 

has three identical modems for the and that it has multilink connections enabled. 

connection, but only one modem . Verify that you need to dial the same or different 

establishes a network link with the phone numbers when establishing a multilink 

remote server. connection. 

. Cycle the power on the modems. Verify that 
they are properly attached to the computer and 
the telephone line. 
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Table 15-2 RAS Troubleshooting (continued) 


Network Printing Problem Solutions 


A network link is broken during a 1. Your phone line probably has call waiting and 

remote session after a successful link another call came in. Disable call waiting 

is established. through the connection object. 

. If your telephone line quality is poor (old wiring, 
phone lines pass by electrical interference, or the 
weather is bad), connection interruptions are 


common. You may need to upgrade your inter- 
nal wiring, request a service upgrade from the 
telephone company, reroute wiring to avoid 
interference, or wait until the weather clears. 

. Remote systems can disconnect you for a variety 
of reasons, most beyond your control and knowl- 
edge. In most cases, simply try to re-establish the 
connection. 


TROUBLESHOOTING NETWORK PROBLEMS 


Network problems range from faults in the network cables or hardware, to misconfig- 
ured protocols, to workstation or server errors. As with all troubleshooting, attempt to 
eliminate the obvious and easy (such as physical connections and permissions) before 
moving on to more drastic, complex, or unreliable measures (such as IP configuration, 
routing, and domain structure). Cabling, connections, and hardware devices are just as 
suspect as the software components of networking. Verifying hardware functionality 
involves more than just looking at it; you may need to perform some electrical tests, 
change physical settings, or even update drivers or ROM BIOS settings. 


Common-sense first steps include the following: 


m Check to see if other clients or servers or subnets are experiencing the 
same problem. 


a Check physical network connections, including the NIC, media cables, ter- 
minators, and logically proximate network devices (such as hubs, repeaters, 
routers, etc.). 


a Check protocol settings. 
a Reboot the system. 


a Verify that the NIC drivers are properly installed. Use the self-test or diag- 
nostic tools or software for the NIC if available. 


a Verify the domain/workgroup membership of the client. 
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Table 15-3 Network Connection Troubleshooting 


Solutions 


Connectivity Problem 


The client does not seem to connect to 
the network (i.e., no objects are visible 
in the Network Neighborhood). 

--Or-- 

The client is unable to authenticate with 
the domain. 


qe 


2. 


Use the Event Viewer to look for errors in the 
System log. Resolve any issues discovered. 
Check the physical network connections, 
including the NIC, media, and local network 
devices. 


. Check the NIC driver; update or replace if 


necessary. 


. Check the installed protocol and its configuration 


settings. 


. Check the domain/workgroup membership. 
. Reboot the client. 


A system disconnects from the network 
randomly or when other computers 
boot onto the network. 


. Check to see that you are not violating the 


length, segments, or nodes-per-segment 
limitations on the network media in use. 


. Verify that all systems have unique address 


assignments and system computer names. 


. Check for breaks in the network media or the 


proximity of electrical or magnetic interference. 


Shared network resources, such as 
folders and printers, cannot be accessed 
from a client. 


. Check the assigned permissions on the share 
itself and on the object (if applicable). 

. Check group memberships for Deny permissions. 

. Attempt to access the resources using a different 

user account or client. 

. Check that the computer is connecting to the 

network. 


TROUBLESHOOTING DISK PROBLEMS 


The hard drive is the component on your computer that experiences the most activity, even 
more than your keyboard or mouse. It should not be surprising that drive failures are com- 
mon. Windows XP Professional maintains and tunes its file system automatically (see 
Chapter 4), but even a well-tuned system is subject to hardware glitches. Most partition, boot 
sector, and drive configuration faults can be corrected or recovered using the Disk 
Management tool in the Computer Management utility in Administrative Tools (for detailed 
information on using this tool and on troubleshooting disk problems, see Chapter 4). 
However, the only reliable means of protecting data on storage devices is to maintain an 
accurate and timely backup, as discussed in Chapter 14, “Windows XP Fault Tolerance.” 


MISCELLANEOUS TROUBLESHOOTING ISSUES 


The following is a “grab bag” of troubleshooting tips that don’t fit into the other cate- 


gories described in this chapter. 
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Permissions Problems 


Permissions problems (problems with accessing or managing system resources like fold- 
ers, files, or printers) usually occur when a user is a member of groups with conflicting 
permissions or when permissions are managed on a per-account basis. To test for faulty 
permission settings, attempt the same actions and activities with Administrator privileges 
(try Hands-on Project 15-5). Double-check a user’s group memberships to verify that 
Deny access settings are not causing the problem. This means examining the access con- 
trol lists (ACLs) of the objects and the share, if applicable (see Figure 15-11). 


Permissions for Finance 


Share Permissions | 


Group or user names: 


@ Everyone 


Permissions for Everyone Allow Deny 


Full Control 
Change 
Read 


Figure 15-11 Setting share permissions 


It is important to remember that any changes to the access permissions for indi- 
vidual users or groups will not affect those users until the next time they log on. 

note | The access token used by the security system is created each time a user logs 
on, but is not altered as long as they stay logged on. This means that any time 
you need to make sweeping changes to file system or share permissions, it's a 
good idea to do so when few users are logged on, and to disconnect those users 
to force them to log back in under the new permissions regime! 


Master Boot Record Problems 


As you learned in Chapter 13, the Master Boot Record (MBR) is the area of a hard 
drive that contains the data structure for initiating the boot process. However, if the 
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MBR fails, the Emergency Repair Disk (ERD) cannot be used to repair it. Instead, you 
must use a recovery tool of some kind, for which there are several approaches: 


a Boot from the Windows XP Professional boot floppies (all 6 of them), use F8 
to select the alternate boot menu, then select the Recovery Console from 
that menu. 


a Reconfigure your system BIOS to boot from your CD player, then boot from 
the Windows XP Professional installation CD. Here you can select Repair 
damaged installation as an option, and also access the Recovery Console. 


a If neither of the preceding methods works, you'll need to use a DOS 6.0 (or 
later) bootable floppy to boot into DOS. 


If you can access the Recovery Console, use the FIXMBR command to repair the 
MBR. If you are forced to boot into DOS, then use the FDISK/MBR command. At 
that point, execute the command fdisk/mbr, which will re-create the drives MBR and 
restore the system correctly. If you don’t have access to the FDISK, you'll have to per- 
form a complete install/upgrade of Windows XP Professional to allow the setup routine 
to re-create the MBR. 


Using the Dr. Watson Debugger 


Windows XP Professional has an application error debugger called Dr. Watson. This 
diagnostic tool detects application failures and logs diagnostic details. Data captured by 
Dr. Watson are stored in the Drwtsn32.log file. Dr. Watson can also be configured to save 
a memory dump of the application’s address space for further investigation. However, 
the information extracted and stored by Dr. Watson is really only useful to a technical 
professional well versed in the debugger’s cryptic logging syntax. 


Windows XP Professional automatically launches Dr. Watson when an application error 
occurs. To configure Dr. Watson, however, you'll need to launch it from the Start, Run 
command with drwtsn32.exe. Figure 15-12 shows the configuration dialog box for Dr. 
Watson. As you can see, this dialog box lists the configuration items for the following: 


a Log File Path—Where the Dr. Watson log file is stored 


a Crash Dump—Provides the dump location for an application’s virtual 
machine’s address space 


a Number of Instructions 
a Number of Errors To Save 


a Options of what to include in log file and how to notify the user 
of an application fault 


a A list of previous Application Errors, with access to the log file details 
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* Dr. Watson for Windows 


Log File Path: EUMENE RE Browse... | 
Crash Dump: fF: \Documents and Settings ‘4ll Browse... | 
Jave File Browse 
Number of Instructions: 
Number of Errors To Save: 
Crash Dump Type: © Full © Mini  NT4 compatible Full 
Options 
I Dump Symbol Table 
V Dump All Thread Contexts 
IV Append To Existing Log File 
I Visual Notification 
I Sound Notification 
V Create Crash Dump File 


Application Errors 


Cancel Help 


Figure 15-12 Dr. Watson configuration dialog box 


APPLYING SERVICE PACKS AND HoT FIXES 


A service pack is a collection of code replacements, patches, error corrections, new appli- 
cations, version improvements, or service-specific configuration settings from Microsoft 
that corrects, replaces, or hides the deficiencies of the original product, preceding service 
packs, or hot fixes. A hot fix is similar to a service pack, except that it addresses only a 
single problem, or a small number of problems, and may not be fully tested (and is not 
normally supported, unless you have a special service agreement with Microsoft). 


You should apply a hot fix only if you are experiencing the problem it was 
A created to solve; otherwise, the hot fix may cause other problems. Most pro- 


caution | duction environments avoid using hot fixes whenever possible in favor of 
waiting until the next service pack rolls them up in a form that is fully tested 
and better supported. The exception to this rule is security-related hot fixes, 
in which case the affected machine might remain vulnerable to a documented 
threat or attack if the hotfix is not applied. 


Service packs are cumulative. For example, Service Pack 3 (SP3) for Windows 2000 
Professional contains SP2 plus all post-SP2 hot fixes. Thus, the latest service pack is all you 


need to install. For instructions on installing and removing service packs, try Hands-on 
Projects 15-6 and 15-7. 
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At this writing, Microsoft has not yet announced a release date for the first 
service pack for Windows XP Professional. Thus, this section of the chapter is 

note | based on pre-release documentation and our experience with Windows 2000 
service packs. Take the time to review the documentation included with a real 
Windows XP Professional service pack once it is available. 


It is also common practice among production networks to wait one to three 
months after the release of a new service pack before deploying it. This gives 

note | the installed community time to test and provide feedback about the patch. 
The track record of service packs from Microsoft is not perfect, so it's better 
to wait for verification of a service pack's reliability than to deploy it immedi- 
ately after its release and live to regret it. 


Important points to remember about patches such as service packs and hot fixes include: 


a Always make a backup of your system before applying any type of patch; this 
will give you a way to restore your system if the fix damages the OS. 


a Be sure you've retrieved a patch for the correct CPU type and language version. 


a Always read the readme and Knowledge Base Q documents for each patch 
before installing it. 


m Update your Emergency Repair Disk (ERD) both before and after applying 
a patch. 


a Make a complete backup of the Registry using the Registry Editor or the 
REGBACK utility on the Microsoft Windows XP Professional Resource Kit. 


a Export the disk configuration data from Disk Administrator. 


a Because service packs rewrite many system-level files, you must disconnect all 
current users, exit all applications, and temporarily stop all unneeded services 
before installing any service pack or patch. 


To locate Microsoft Knowledge Base documents, visit or use one of these resources: 


a Web site: http: //support.microsoft.com/ 
a TechNet CD 
a Microsoft Network 
a Resource Kit documentation (online help file) 
Service packs and hot fixes can be retrieved from: 
a Microsoft FTP site: ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes /usa/ 


m The Download section of the Microsoft Windows Web site: 
http: //www.microsoft.com /downloads / 
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To determine what service packs have been applied to your system, you can use one 
of the following techniques: 


a Enter WINVER from a command prompt to view an About Windows 
dialog box. 


a Select Help, About Windows from the menu bar of any native tool such 
as My Computer or Explorer. 


a Use the Registry Editor to view the CSDVersion value in the 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ WindowsNT\ 
CurrentVersion. 


MICROSOFT TROUBLESHOOTING REFERENCES 


Several Microsoft resources can aid you in troubleshooting and working with Windows XP 
Professional: 


a The Microsoft Windows Web site—http://www.microsoft.com/windowsxp / 


a The Knowledge Base—The predecessor to and a resource for the TechNet CD 
is the online Knowledge Base. This resource can be accessed by several 
means, as detailed earlier in this chapter. 


a TechNet—The best periodic publication from Microsoft is TechNet. This 
multi-CD collection is an invaluable resource for white papers, FAQs, trou- 
bleshooting documents, book excerpts, articles, and other written materials, 
plus utilities, patches, fixes, upgrades, drivers, and demonstration software. At 
only $300 per year (as of this writing), it is well worth the cost. It is also 
available online in a limited form at http://technet.microsoft.com/. 


a Resource Kitt—The Resource Kits are useful information sources. These are 
available in electronic form through the CD-based version of TechNet in their 
entirety, and through the online version of TechNet in portions. Resource Kits 
document material above and beyond what’s contained in the manuals and 
on-line help files, and often include additional software utilities to enhance 
product use. These Resource Kit Utilities (as they’re called) often provide 
valuable administrative functionality not available from built-in consoles and 
utilities. They are also available in book form through Microsoft Press. 


CHAPTER SUMMARY 


o No matter what problems or errors are discovered on your computer system, there 
are several common-sense principles of troubleshooting you should always follow. 
These include performing one task at a time, remaining calm, isolating the prob- 
lem, and performing the simplest fixes first. 
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a Information is the most valuable troubleshooting tool. Making sure you have the 
best information includes maintaining a Computer Information File and a detailed 
log or history of troubleshooting activities. 


a The Windows XP Professional tools most often used for troubleshooting are 
Event Viewer and the Computer Management tool. 


a There are five common installation problems: media errors, domain controller 
communication difficulties, stop message errors or halt on blue screen, hardware 
problems, and dependency failures. 


a Printer problems are most often associated with physical configuration or spool- 
ing problems. 


a RAS and network problems may be caused by several types of problems, but the 
most common type arises from misconfiguration. 


a Service packs and hot fixes are used to repair portions of Windows XP Professional 
after its release. 


a Microsoft has provided several avenues to access information about the operation 
and management of Windows 2000, including a substantial collection of trou- 
bleshooting documentation. Much of this is available at no charge from the 
Microsoft Web site. 


KEY TERMS 


Application log — Records application events, alerts, and system messages. 


Computer Information File (CIF) — A detailed collection of all information 
related to the hardware and software products that comprise your computer (and 
even your entire intranet). 


Dr. Watson — An application error debugger. This diagnostic tool detects application 


failures and logs diagnostic details. 15 
Event Viewer — The utility used to view the three logs automatically created by 


Windows 2000: the System log, Application log, and Security log. 

hot fix — Similar to a service pack, except that a hot fix addresses only one problem, 
or a small number of problems, and may not be fully tested. 

master boot record (MBR) — The area of a hard drive that contains the data 
structure that initiates the boot process. 

Security log — Records security-related events. 

service pack — A collection of code replacements, patches, error corrections, new 
applications, version improvements, or service-specific configuration settings from 
Microsoft that corrects, replaces, or hides the deficiencies of the original product, 
preceding service packs, or hot fixes. 

System log — Records information and alerts about Windows XP Professional’s 
internal processes. 
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REVIEW QUESTIONS 


1. 


When approaching a computer problem, which of the following should you keep 
in mind? (Choose all that apply.) 


a. How the problem was last solved. 

b. What changes were recently made to the system. 

c. Information about the configuration state of the system. 
d. Ability to repeat the failure. 


. Ifa media error occurs during installation, which of the following steps should 


you take to eliminate the problem? (Choose all that apply.) 

a. Attempt to re-copy or re-access the file that caused the failure. 
b. Switch media sources or types. 

c. Open the Control Panel and reinstall the appropriate drivers. 
d. Restart the installation from the beginning. 


. Which of the following Windows repair tools can be used to gain information 


about drivers or services that failed to load? 
a. Event Viewer 

b. Registry 

c. System applet 

d. Dr. Watson 


. In addition to the Event Viewer and System Information, which of the following 


are useful tools in general troubleshooting? (Choose all that apply.) 
a. Advanced Options Boot Menu 

b. Registry Editors 

c. Backup software 

d. Time/Date applet 


. Your best tool in troubleshooting is: 


a. A protocol analyzer 
b. Information 

c. Administrative access 
d. Redundant devices 


. Which of the following are possible troubleshooting techniques for eliminating 


printer problems? (Choose all that apply.) 

a. Check the physical aspects of the printer: cable, power, paper, toner, and so on. 
b. Check the print queue for stalled jobs. 

c. Attempt to print from a different application or a different client. 

d. Stop and restart the spooler using the Services tool. 

e. Disconnect from the network. 


Ta 


10. 


11 


12. 
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Which of the following are common RAS problems? 
a. Telco service failures 

b. Misconfiguration 

c. User error 


d. Communication device failure 


. A user’s ability to access a resource is controlled by access permissions. If you sus- 


pect a problem with a user’s permission settings, what actions can you take? 
(Choose all that apply.) 


a. Attempt the same actions and activities with the Administrator account. 
b. Delete the user’s account and create a new one from scratch. 


c. Double-check group memberships to verify that Deny access settings are not 
causing the problem. 


d. Grant the user Full Access to the object directly. 


. What application automatically loads to handle application failures? 


a. Event Viewer 

b. System applet 

c. Computer Management 

d. Dr. Watson 

If you are going to create a CIE which of the following is the most important? 
a. Include the vendor’s mailing address 

b. Keep everything in electronic form 

c. Update the contents often 


d. Use non-removable labels on all components 


. Which of the following are important actions to perform before installing a ser- 


vice pack or a hot fix? (Choose all that apply.) 

a. Make a backup of your system. 

b. Read the readme and Knowledge Base Q documents. 

c. Make a complete backup of the Registry. 

d. Enable virus protection. 

What are some common-sense approaches to troubleshooting? 
Understand TCP/IP routing table configuration 


a. 
b. Know your system 


a 


. Undo the last alteration to the system 


a 


. Replace all server hardware when one device fails 


e. Let the fault guide you 
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13: 


14. 


15. 


16. 


17. 


18. 


19. 


20. 


You can often resolve problems or avoid them altogether if you take the time to 
write out a history or log of problems and both failed and successful solution 
attempts. True or False? 


When installing a new Windows 2000 domain controller into an existing domain, 
you can experience communication problems with the current domain controller. 
After you’ve verified that the current domain controller is online and properly 
connected to the network, what other items should be considered as possible 
points of failure? (Choose all that apply.) 


a. shorten the computer name from 12 to 10 characters. 
b. subnet mask 

c. password 

d. domain name 


Blue screen or Stop errors are often caused by a system when one or more 
devices are not found on the HCL. True or False? 


If the driver for your network interface card fails, which other components of your 
system are most likely to fail due to dependency issues? (Choose all that apply.) 


a. network protocol 

b. Client Services for NetWare 
c. video driver 

d. WinLogon 


Errors involving internal processes such as hardware and operating system errors, 
warnings, and general information messages are recorded in the Application log of 
the Event Viewer. True or False? 


Which of the following are valid methods for resolving hardware problems? 
(Choose all that apply.) 


a. Restart the installation from scratch without any other modifications 
b. Press and hold the Ctrl key during the installation 

c. Remove or replace the non-HCL hardware 

d. Recopy the distribution files 


An event detail viewed from the Event Viewer’s logs provides specific information 
on the time, location, user, service, and resolution for all encountered errors. True 
or False? 


The Computer Management tool offers links to several important administrative 
and management utilities including: (Choose all that apply.) 


a. Control Panel 
b. Event Viewer 


c. Performance Monitor 


[= 


. Local Security Policy 


e. Local Users and Groups 
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21. The Storage section of the Computer Management tool offers utilities to perform 
what types of operations? (Choose all that apply). 


a. Defragmentation 

b. Partitioning 

c. Managing Removable Storage 
d. Compressing Floppies 


22. When a printer fails to print your documents, which of the following is a useful 
first step in troubleshooting? 


a. Replacing the printer 

b. Restarting the spooler 

c. Re-installing the operating system 

d. Delete and re-create the shared printer 


23. Both printers and RAS connections can suffer from the most common problem: 
physical connection interruptions. True or False? 


24. When a user complains about being unable to access a resource that other users 
of similar job descriptions are able to access, what should you consider when 
attempting to troubleshoot this issue? (Choose all that apply.) 


a. Group memberships 

b. ACL on the object 

c. Domain membership 

d. Speed of network connection 


25. When you alter the group memberships of a user, how do you ensure that the 
changes take eftect? 


a. Reboot the server 


b. Enable auditing on file objects 


c. Restart the messaging and alert services 


d. Log the user account out, then allow them to log back in 


HANDS-ON PROJECTS 


y Project 15-1 
iih To use the Event Viewer: 


1. Open the Event Viewer from the Start menu (Start| Control Panel | 
double-click Administrative Tools | double-click Computer Management | 
Event Viewer to display the list of available logs). 
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Select the System log from the list of available logs in the left pane. 
Notice the various types of events that appear in the right pane. 
Select an event in the right pane. 


Select Action | Properties (or more simply, double-click the event entry). 


DS OU ee oS 


Review the information presented in the Event Properties dialog box. Try to 
determine on your own what types of errors, warnings, or information is pre- 
sented in the detail and why the detail was created. 


7. Click the up and/or down arrows to view other event details. 
8. Click OK to close the event detail. 


9. Select File | Exit to close Event Viewer. 


Project 15-2 


To extract information for a CIF: 
This hands-on project suggests a method to obtain some information about 


your system for a CIF; it does not constitute a complete or exhaustive collec- 
note | tion of data. This activity is only one part of the task of creating a CIF. 


1. Click Start |All Programs | Accessories | System Tools | System Information. 


(0) System Information EEE) 


File Edit View Tools Help 


System Summary Item Value 


Hardware Resources OS Name Microsoft Windows XP Professional 
E- Components Version 5.1.2494 Build 2494 
E- Software Environment OS Manufacturer Microsoft Corporation 
Œ Internet Settings System Name WXPPR0-191 
System Manufacturer System Manufacturer 
System Model System Name 
System Type X86-based PC 
Processor x86 Family 6 Model 3 Stepping 3 Genuinelntel “300 Mhz 
BIOS Version/Date Award Software, Inc. #40140-0102s, 9/9/1997 
SMBIOS Version 2.0 
Windows Directory E:\WINDOWS, 
System Directory E:WINDOWS \System32 
Boot Device \Device\HarddiskVolume1 
Locale United States 
Hardware Abstraction Layer Version = '"5.1.2494.0 (main.010613-1 739)" 
User Name WPPRO-191\Boo 
Time Zone Central Daylight Time 
Total Physical Memory 128.00 MB 
Available Physical Memory 35.24 MB 
Total Virtual Memory 435.51 MB 
Available Virtual Memory 241.35 MB 
Page File Space 307.96 MB 
Page File E:\pagetile. sys 


< m | 


> 
Find what: | Find Close Find 


C Search selected category only  [[] Search category names only 


Figure 15-13 The System Information tool 


Hands-on Projects 597 


. Expand the four dependents of the System Summary entry in the left hand 


pane—that is, Hardware Resources, Components, Software Environment, 
and Internet Settings—by clicking the boxed plus sign to the left of each unex- 
panded node. 


. Take the time to expand and select every item in the resulting node hierarchy. 


As you view each page of data, consider the value of this data for future trouble- 
shooting and decide whether to print or save the information. 


4. To print a page, click the Print entry in the File menu from the menu bar. 


5. To save a page, click on the Save entry in the File menu from the menu bar (this 


6. 


produces text-only .NFO or information files for later examination and use). 


When you have finished examining your System Information, close the utility. 
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"me || To explore the Computer Management utility: 


1. 


Open the Control Panel (Start | Control Panel). 


2. Double-click Administrative Tools. 
3. 
4. Notice that the left hand pane hosts three divisions: System Tools, Storage, and 


Double-click Computer Management. 


Services and Applications. 


. Expand the System Tools entry by clicking the boxed plus sign located to the 


left of the node name. 


. Explore the contents of the Event Viewer, Performance Logs and Alerts, Shared 


Folders, Device Manager, and Local Users and Groups sections by expanding 
them one at a time. To view the contents of any item, select it in the left pane 
so its contents will be displayed in the right pane. 


. Once you’ve viewed the contents of the System Tools section, view the contents 


of the Storage section. This section includes Disk Management, Disk 
Defragmenter, and Removable Storage. 


. Once you’ve viewed the contents of the Storage section, view the contents of the 


Services and Applications section. The items in this section vary based on installed 
applications and services but can include WMI Control, Services, and Indexing 
Service. 


. Once you’ve viewed the contents of the Services and Applications section, close 


the Computer Management utility. 
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Project 15-4 


To troubleshoot a printer problem: 


Hani 
Project 


This hands-on project is not an exhaustive process for printer troubleshoot- 
ing; it includes some of the actions that may be required to resolve a printer 
Note problem. 


1. First, check that the printer is online, has power, has paper, and has toner. Check 
the printer’s own error reporting center (often a light or an LCD) for any possible 
hardware errors. 


2. Open the Printers applet (Start| Printers and Faxes). 


3. Double-click the installed printer that you suspect is having a problem to display 
the printer queue window. 


4. If any documents appear in the printer queue window, select the topmost docu- 
ment, then select Document | Restart. 


If the printer still fails to function, go to the Control Panel (Start| Control Panel). 
Double-click the Administrative Tools icon. 


Double-click Computer Management. 


ee Ol 


Navigate down in the hierarchy of the left pane to locate and select the Services 
tool (Computer Management, Services and Applications, Services). 


9. Locate and select the Print Spooler service in the Extended tab (see Figure 15-14). 


g Computer Management DER 
(Sy Fie Action view Window Help 

e» Amene’ m 

Computer Management (Local) 


iB System Tools 
(È Event Viewer 


41-6 Shared Folders Print Spooler Name _/ Description | Status | Startup Type & 
ka Local Users and Group: NetMeeting Remote... Enables an... Manual 


E} 


t 
Device Manager Restart the service By Network DDE Provides n... Manual 


=) Storage y Network DDE DSDM Manages D... Manual 
E £ Removable Storage | Description: Ky Network Location A... Collects an... Started Manual 


EA pertomaneo Logs ond Stop the service ByNetwork Connections Manages o... Started Manual 


Disk Defragmenter | Loads files to memory for later printing. snr LM Security Sup... Provides s... Manual 


Disk Management ByPerformance Logs a... Collects pe... Manual 

fi Services and Applications BsPlug and Play Enables ac... Started Automatic 

z Services Sy Portable Media Seri... Retrieves t... Started Automatic 

WMI Control Merint Spooler Loadsfiles... Started Automatic 

(4) $2} Indexing Service Byprotected Storage Provides pr... Started Automatic 
By QoS RSVP Provides n... Manual 
ByRemote Access Aut... Creates a... Manual 
Started Manual 


>) \ Extended A Standard 7 


Figure 15-14 The Computer Management tool; Services and Applications 


10. Select Action | Stop. 
11. Select Action | Start. 


Ei 
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. Close the Computer Management utility. 
. Close the Control Panel. 


. If the printer still fails to function, return to the Printer queue window that was 


left open. 


. Select the topmost document in the printer queue. 


. Click the Document menu, then select the Cancel command to remove the 


print job from the queue. 


. If this was the only print job in the queue, print another document. If this was 


not the only print job in the queue, wait to see if the remaining print jobs print. 
Consult Chapter 9 for more details on managing printers. 
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To troubleshoot permission problems: 


This hands-on project is not an exhaustive process for permission trou- 
bleshooting; it includes some of the actions that may be required to resolve 
Note permission problems. 


. If a user cannot access a resource to which they should have access, first reboot 


their system (Start | Shutdown). Select Restart from the pull-down menu, then 
click OK. 


After rebooting, log back in as the user. Test to see if you can access the resource. 


3. If the resource is still not accessible, log out and log back in as an administrator: 


Press Ctrl+Alt+Delete at the logon prompt, then provide the user account name 
for the administrator and the associated password. Click OK. 


. Once logged in as the administrator, attempt to access the resource. If the resource 


can be accessed, the problem is with the assigned permissions for the user 
account. Most likely the user account is not a member of the proper group or is a 
member of a group that has Deny access set for that resource. 


If the resource cannot be accessed by the administrator, the problem may lie with 
the system itself. This could include network communications, domain member- 
ship, or corrupted system drivers and files. You will need to troubleshoot these 
other possible causes of the problem. 


If you discover that group membership is the problem, make the appropriate 
group membership changes, then force the user to log out and log back in 
(changes do not take effect until the next logon). 
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Project 15-6 
To apply a service pack: 


1. 


Move or copy the service pack (SP) file into an empty directory as follows. From 
within Windows Explorer, create a new directory on a volume with at least 100 MB 
of free space (more may be required depending on the size of the service pack). 
Move or copy the SP into the new empty directory. 


. Close all applications, especially debugging tools, virus scanners, and any other 


non-Microsoft or third-party tools. 


. Locate and execute Update.exe with the Start|Run command. 


. Follow any prompts that appear. If you want the ability to uninstall the service 


pack, be sure to select the option to store uninstall information. It’s generally a 
good idea to select this option. 


. When instructed, reboot your system. 


. After rebooting, you can delete the service pack files and the temporary directory 


from your hard drive (refer to step 1). 


Project 15-7 


To uninstall a service pack: 


You must have selected the “save uninstall information” option during the 
| initial application of the service pack in order to uninstall it. 
Note 


1. 


ne UO N 


Extract the original SP archive into an empty directory. If you retained the SP 
archive and temporary directory from the installation procedure, you do not need 
to repeat this activity. 


. Locate and execute Update.exe. 

. Click the Uninstall a previously installed service pack button. 
. Follow the prompts. 

. Reboot. 
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To verify that the Workstation and Server services are started after bootup: 


1. 


Open the Control Panel (Start | Control Panel). 


2. Double-click Administrative Tools. 
3. 
4 


. Expand the Services and Applications section by clicking on the boxed plus 


Double-click Computer Management. 


sign next to the node name if it is not already expanded. 
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. Select the Services object. 
. Scroll down in the right pane to locate the Workstation service. 


. Notice the item in the Status column. If it says “Started,” you can skip to step 9. 


oO N DW WI 


. If the Status column is blank for the Workstation service, it failed to launch 
at startup. You can attempt to launch the service by selecting it, clicking the 
Action menu, then clicking Start. 


9. Scroll down in the right pane to locate the Server service. 
10. Notice the item in the Status column. If it says “Started,” you can skip to step 12. 


11. If the Status column is blank for the Server service, it failed to launch at startup. 
You can attempt to launch the service by selecting it, clicking the Action menu, 
then clicking Start. 


12. Close the Computer Management console by clicking on the X button on the 
title bar. 


CASE PROJECTS 


1. After installing a new drive controller and a video card, along with their associated 


in 

wi drivers, Windows XP Professional refuses to boot, and booting with the Last Known 
Case $ A . . 

mee Good Configuration (LKGC) option does not result in an operational system. 


Required Result: 
Return the system to a bootable and operational state. 


Optional Desired Results: 
Retain the Security ID. 
Retain most, if not all, of the system’s configuration. 


Proposed solution: 
Perform a complete reinstallation of Windows 2000. 


a. The proposed solution produces the desired result and produces both of the 


optional desired results. 


b. The proposed solution produces the desired result, but only one of the 
optional desired results. 


c. The proposed solution produces the desired result, but neither of the optional 
desired results. 


d. The proposed solution does not produce the desired result. 
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2. After installing a new drive controller and a video card, along with their associ- 
ated drivers, Windows XP Professional refuses to boot, and the LKGC does not 
result in an operational system. 


Required Result: 
Return the system to a bootable and operational state. 


Optional Desired Results: 

Retain the Security ID. 

Retain most, if not all, of the system’s configuration. 
Proposed solution: 

Perform an upgrade reinstallation of Windows 2000. 


a. The proposed solution produces the desired result and produces both of the 
optional desired results. 


b. The proposed solution produces the desired result, but only one of the 
optional desired results. 


c. The proposed solution produces the desired result, but neither of the optional 
desired results. 


d. The proposed solution does not produce the desired result. 


3. Describe the common problems associated with installing Windows XP 
Professional and the appropriate steps to either avoid these problems or resolve 
them once encountered. 


